Data Protection

§ 1

Responsible Party — Verantwortlicher

§ 2

Data Collected — Erhobene Daten

This website does not use cookies, tracking, analytics, or advertising. No personal data is collected automatically through this site beyond what your browser and the hosting provider (GitHub Pages) log as part of standard server operation.

Server logs (GitHub Pages / Fastly CDN): When you visit this site, GitHub Pages automatically records standard access data including your IP address, browser type, referring URL, and timestamp. This data is processed by GitHub, Inc. (a Microsoft subsidiary) and is outside the direct control of this site's operator. Retention is governed by GitHub's own policies. For details see: GitHub Privacy Statement.

Email contact: When you contact ECHOx by email, the content of your message and any personal data it contains (name, email address, other information you choose to include) are stored for the purpose of responding and fulfilling the contractual or pre-contractual relationship. This data is stored on ProtonMail servers (Proton AG, Geneva, Switzerland), which provides end-to-end encryption and operates under Swiss and EU privacy law.

Instagram DM: Direct messages sent via Instagram are processed by Meta Platforms Ireland Ltd. under Meta's own privacy policy. ECHOx has no control over Meta's data processing.

Photography sessions: When you book a session, contact details (name, email) are retained for invoicing and communication purposes. Photographs in which you appear are processed as described in § 4 below.

§ 3

Legal Basis — Rechtsgrundlage

• Art. 6 Abs. 1 lit. a DSGVO — Consent: where you have explicitly agreed to processing, e.g. by participating in a photography session.
• Art. 6 Abs. 1 lit. b DSGVO — Contractual necessity: processing required to fulfil a booking, invoice, or delivery of photographs.
• Art. 6 Abs. 1 lit. c DSGVO — Legal obligation: retention of invoicing records for up to 10 years under § 147 AO (German Tax Code).
• Art. 6 Abs. 1 lit. f DSGVO — Legitimate interest: responding to inquiries and communications.
• § 23 KUG (Kunsturhebergesetz): photographs of persons may be published without individual consent where they form part of an artistic or documentary work, subject to the limits of § 23 KUG.

§ 4

Photographs of Persons — Bildnisse

By participating in a photography session with ECHOx, you consent to the taking and use of photographs in which you appear, in accordance with the Terms & Conditions. This constitutes consent under Art. 6 Abs. 1 lit. a DSGVO and the right of publication under § 22 KUG.

You may withdraw this consent at any time for future use by contacting ECHOx in writing at [email protected]. Withdrawal does not affect the lawfulness of processing prior to withdrawal, and does not require the deletion of photographs already published as part of an artistic body of work where § 23 KUG applies.

§ 5

Retention Periods — Speicherdauer

• Email correspondence: retained for the duration of the business relationship and up to 3 years thereafter, unless longer retention is required by law.
• Invoicing and payment records: retained for 10 years in accordance with § 147 AO and § 257 HGB.
• Session booking information: retained for 3 years from the date of the session.
• All other personal data: deleted as soon as the purpose for which it was collected has been fulfilled and no statutory retention obligation applies.

§ 6

Your Rights — Ihre Rechte

Under the DSGVO, you have the following rights regarding your personal data:

• Art. 15 DSGVO — Right of access: you may request confirmation of whether personal data concerning you is being processed and, if so, access to that data.
• Art. 16 DSGVO — Right to rectification: you may request correction of inaccurate personal data.
• Art. 17 DSGVO — Right to erasure ("right to be forgotten"): you may request deletion of personal data where it is no longer necessary or where you withdraw consent.
• Art. 18 DSGVO — Right to restriction of processing.
• Art. 20 DSGVO — Right to data portability.
• Art. 21 DSGVO — Right to object: you may object to processing based on legitimate interest at any time.
• Art. 7 Abs. 3 DSGVO — Right to withdraw consent at any time without affecting prior lawful processing.

To exercise any of these rights, contact: [email protected]

§ 7

Right to Lodge a Complaint — Beschwerderecht

You have the right to lodge a complaint with the competent data protection supervisory authority. For Berlin, this is:

§ 8

Third-Party Services

• GitHub Pages (GitHub, Inc. / Microsoft): Website hosting. May process server access logs. GitHub Privacy Statement →
• Google Fonts: This site loads fonts from Google's servers. Your IP address is transmitted to Google with each page load. Legal basis: Art. 6 Abs. 1 lit. f DSGVO (legitimate interest in consistent typography). Google Privacy Policy →
• ProtonMail (Proton AG): Email provider for [email protected]. End-to-end encrypted. Subject to Swiss Federal Act on Data Protection (nFADP) and GDPR. Proton Privacy Policy →
• Meta / Instagram: Instagram profile @berlinechoes is operated on Meta's platform. Meta processes data under its own privacy policy. ECHOx has no control over Meta's data processing.

§ 9

Changes to This Policy

This privacy policy may be updated to reflect changes in legal requirements or the services used. The current version is always availabl